Description
Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions.
Published: 2026-07-02
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Fuelthemes Werkstatt theme in WordPress versions up to 4.8.3 contains a PHP Object Injection vulnerability (CWE‑502). Attackers who can submit serialized data to the theme are able to trigger an unserialize operation that executes arbitrary PHP code. This flaw can compromise the confidentiality, integrity and availability of the site, as the attacker could gain full control of the affected system.

Affected Systems

All WordPress installations that include the Fuelthemes Werkstatt theme version 4.8.3 or any earlier release are affected. If the theme is still present on a live site, the vulnerability remains exploitable until the theme is removed or upgraded.

Risk and Exploitability

The CVSS score of 8.8 classifies this defect as high severity. The EPSS score of <1% indicates a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. The likely vector is remote; an attacker can trigger the vulnerability by sending crafted HTTP requests containing malicious serialized payloads to the theme, for example via contributor or custom fields that the theme deserializes.

Generated by OpenCVE AI on July 22, 2026 at 13:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Werkstatt theme to the latest version that contains the PHP Object Injection fix.
  • If an upgrade cannot be performed, deactivate the Werkstatt theme and switch to an alternative theme to eliminate the vulnerable code path.
  • In the meantime, locate any unserialize calls in the theme's PHP files that handle user‑supplied data, replace them with safer deserialization functions such as json_decode, or add strict validation to ensure the payload is not an object.

Generated by OpenCVE AI on July 22, 2026 at 13:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Fuelthemes
Fuelthemes werkstatt
Wordpress
Wordpress wordpress
Vendors & Products Fuelthemes
Fuelthemes werkstatt
Wordpress
Wordpress wordpress

Thu, 02 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Description Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions.
Title WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Fuelthemes Werkstatt
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-02T15:53:44.804Z

Reserved: 2026-02-19T09:52:22.262Z

Link: CVE-2026-27414

cve-icon Vulnrichment

Updated: 2026-07-02T13:39:04.278Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-22T14:00:04Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data